Fun fact: This malware often comes from accounts on your friends list. When hackers steal an account, they use it to message all of that user’s friends. This means a dangerous link might come from someone you know.
What is Black Discord? #
Black Discord is a dangerous file that installs the XWorm Trojan on your computer. It is a remote access tool. It works as a data stealer and as ransomware at the same time.
Everything known about Black Discord so far #
The trojan exe: The malware looks like a game file or a test link. When you open it, it opens a hidden window. It runs a fake file called discord.exe from your temporary folder.
Account stealing: The malware steals your Discord login token. This lets hackers log into your account without your password or your two-factor code.
Full remote access: It gives hackers full control of your computer. They can use a tool called SSH to access your system.
Data harvesting: It steals saved passwords, web cookies, credit card numbers, crypto wallets and Steam accounts.
Spying: The malware records the keys you press. It also takes screenshots of your screen.
Ransomware: XWorm can lock your files. The hackers will then ask for money to give your files back.
Technical behavior and persistence #
The malware changes system files and uses hidden tricks to stay on your computer.
- Process chain: When it runs, it starts a chain of files. It opens
black discord.exe, thenmain.exe, and finallysystem32.exe. - Task Scheduler: It creates startup files. It hides its instructions inside the Windows Task Scheduler so it runs every time your PC turns on.
- Using real tools: It uses real Windows applications to run its commands.
- Antivirus loophole: Because it uses real Windows tools, normal antivirus software often cannot find it after it installs.
- Command and Control: The malware connects to a hacker website. It uses Discord webhooks to send your stolen data to the hacker.
How to detect and protect your system #
Basic antivirus scans might miss this malware because it hides inside real Windows files. You need to check your network connections instead.
You can download a free tool called TCPView from Microsoft. Open it to see every program connecting to the internet. If you see standard Windows tools connecting to strange websites, your PC might have the malware.
Never open .exe or .scr files from Discord messages. Check your Authorized Apps in your Discord settings and remove things you do not know. If you get infected, uninstall Discord and delete your local AppData folders.